*** runtime.sgml.orig	Thu Dec 21 17:36:17 2000
--- runtime.sgml	Thu Dec 21 17:47:21 2000
***************
*** 1826,1848 ****
     certificate can be used to get started testing, but a certificate signed
     by a CA (either one of the global CAs or a local one) should be used in 
     production so the client can verify the servers identity. To create
!    a quick self-signed certificate, use the <filename>CA.pl</filename>
!    script included in OpenSSL:
  <programlisting>
! CA.pl -newcert
  </programlisting>
!    Fill out the information the script asks for. Make sure to enter
!    the local host name as Common Name. The script will generate a key
!    that is passphrase protected. To remove the passphrase (required
!    if you want automatic start-up of the postmaster), run the command
! <programlisting>
! openssl x509 -inform PEM -outform PEM -in newreq.pem -out newkey_no_passphrase.pem
! </programlisting>
!    Enter the old passphrase to unlock the existing key. Copy the file
!    <filename>newreq.pem</> to <filename><replaceable>PGDATA</>/server.crt</>
!    and <filename>newkey_no_passphrase.pem</> to
!    <filename><replaceable>PGDATA</>/server.key</>. Remove the PRIVATE KEY part
!    from the <filename>server.crt</filename> using any text editor.
    </para>
   </sect1>
  
--- 1826,1848 ----
     certificate can be used to get started testing, but a certificate signed
     by a CA (either one of the global CAs or a local one) should be used in 
     production so the client can verify the servers identity. To create
!    a quick self-signed certificate, use the following commands in OpenSSL:
  <programlisting>
! openssl req -new -text -out cert.req
! openssl rsa -in privkey.pem -out cert.pem
! openssl req -x509 -in cert.req -text -key cert.pem -out cert.cert
  </programlisting>
!    At the first command, fill out the information about your host. Make sure
!    to enter the server host name as Common Name. Pick a temporary password
!    (this is only used during key generation). Note that you do not need to
!    enter anything in the fields for 'extra attributes'. The second openssl 
!    command will remove this password - just enter it once again to unlock
!    the key. A password-less key is required in order for the database 
!    server to start without manual intervention. When you are done, copy 
!    the file <filename>cert.cert</> to
!    <filename><replaceable>PGDATA</>/server.crt</>
!    and <filename>cert.pem</> to
!    <filename><replaceable>PGDATA</>/server.key</>. Remove all other files.
    </para>
   </sect1>